Arpi Labs

Privacy Policy

Rekit (previously "WordsUp") mobile application and related services
Effective date: August 8, 2026 · Version 1.2 · Previous version: August 3, 2026

This Privacy Policy explains how we collect, use, store, and share personal data when you use the Rekit mobile application (previously distributed as "WordsUp"; App Store identifier com.arpilabs.rekit, Google Play and RuStore identifier com.voziart.english), the websites arpilabs.com and wordsupapp.click, and related services (together, the "Services"). This Policy applies together with the Terms of Use. By using the Services you acknowledge that you have read and understood this Policy.

1. Data controller

• FAIZOV ARTUR, Individual Entrepreneur, registered in the Republic of Armenia
• TIN: 20319333
• Contact email: arpilabs@gmail.com
• Website: https://arpilabs.com/

This Policy covers the app as distributed through the App Store, Google Play, and RuStore. On iOS every purchase is made through the App Store, and no other payment method is offered there. On Android, users in Russia pay through YooKassa, because Google's own billing is not available in that country and Google therefore excludes such payments from its payments policy. For that path only, the seller and the controller of the related data is FAIZOV ARTUR ILDUSOVICH, self-employed (professional income tax payer) registered in the Russian Federation, TIN 027318096010, contact email voziart@gmail.com; the policy governing it is written in Russian and opens from inside the app for the users it applies to.

2. Data we collect

Data you provide directly:

• email address — when you create an account or sign in with an email code;
• data received from Google when you use Sign in with Google: email address, Google account identifier and, where available, display name and profile photo URL;
• data received from Apple when you use Sign in with Apple: the identifier Apple assigns to your account for our app and, if you agree to share it, your email address. If you choose Apple's "Hide My Email" option, we receive a relay address generated by Apple instead of your real one, and we treat it as your email address;
• the content of support requests you send to our contact email, including any information you choose to include.

Technical data collected automatically:

• a pseudonymous device identifier and the set of device identifiers previously associated with your account. On Android it is derived from ANDROID_ID; on iOS it is a random identifier generated on first launch and kept in the system keychain, which means it survives reinstalling the app and lets us return a purchase you have already paid for;
• an account identifier we assign to your account when it is created, used to link your account to your data on our servers;
• app installation date, app version, operating system version, device type and model, language, region, and time zone settings;
• over-the-air (OTA) update runtime version and platform, sent with update checks;
• IP address and related network attributes recorded by our server infrastructure;
• request identifiers, timestamps, and HTTP request/response metadata used for diagnostics;
• authentication tokens issued by us and short-lived email verification codes;
• a push notification token, if you grant the operating system permission to send notifications.

Product analytics: app opens, learning session events, key in-app actions (viewing the premium screen, starting and completing a purchase, marking words as learned, completing exercises), and aggregate progress counters.

Payment-related data: payment identifiers, tokenized payment method references, amount, currency, date and status of transactions, selected plan, and applied promo code. For purchases made inside the app through the App Store or Google Play, we additionally receive from the store the purchase or transaction identifier, the product purchased, and subsequent status updates such as renewals, cancellations, and refunds. We never receive or store card numbers, CVV codes, or other payment credentials — these are processed exclusively by the payment processor or by the store.

Microphone and speech recognition: the pronunciation exercises ask you to say a word out loud. While such an exercise is running, and only then, the app records audio from the microphone and passes it to the speech recognition service built into your operating system (Apple on iOS, Google on Android) to convert it into text. Depending on your device and its settings, that service may process the audio on the device itself or on the servers of the operating system vendor, under that vendor's own privacy policy. We do not receive, store, or transmit the audio itself - the app uses the recognized text on your device to check the answer, and only the exercise result (correct or incorrect) reaches us as part of product analytics. Access to the microphone is requested by the operating system and can be withdrawn at any time in system settings; without it the pronunciation exercises are unavailable and the rest of the app works as usual.

Error monitoring and performance data: error messages, stack traces, the sequence of in-app actions preceding an error, technical performance measurements such as launch time and responsiveness, and device/environment information.

Data stored only on your device: your dictionary, learning progress, repetition schedule, statistics, and settings are stored locally on your device and are not routinely transmitted to us. They may be shared with us only at your initiative as part of a support request.

3. Purposes and legal bases

We process personal data for the following purposes:

• Providing the Services (performance of a contract): account access, saving progress, synchronizing premium status across your devices, processing purchases and subscriptions;
• Authentication and account security (performance of a contract, legitimate interests): issuing and rotating tokens, verifying email codes;
• Reliability and quality (legitimate interests): error monitoring, incident diagnostics, delivering app updates, sending push notifications where enabled;
• Security and fraud prevention (legitimate interests): protecting the Services and users from abuse, fraud, unauthorized access, and automated attacks;
• Product improvement (legitimate interests, consent where required): aggregated and pseudonymized usage analytics;
• Communications (performance of a contract): verification codes, payment notifications, responses to support requests;
• Legal compliance (legal obligation): tax, accounting, and record-keeping requirements under applicable law;
• Establishing and defending legal claims (legitimate interests).

4. Third parties and processors

We share personal data only to the extent necessary for the purposes above, with the following categories of recipients:

• Cloud infrastructure and hosting providers — server hosting and operation of our backend infrastructure, acting on our instructions;
• Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) and Google Ireland Limited — Sign in with Google (token verification in exchange for your email address and account identifier), distribution of the app via Google Play, processing of in-app purchases and subscriptions made through Google Play, and the speech recognition service used by the pronunciation exercises on Android. See Google Privacy Policy;
• Apple Inc. (One Apple Park Way, Cupertino, CA 95014, USA) — distribution of the app via the App Store; Sign in with Apple (verification of the identity token in exchange for the account identifier and, where shared, the email address); processing of in-app purchases and subscriptions made on iOS, where Apple acts as the seller of record and sends us the purchase confirmations and status updates described above; and the speech recognition service used by the pronunciation exercises. See Apple Privacy Policy;
• YooKassa (a payment service operated by NBCO YooMoney (JSC), Moscow, Russia) — processing of payments and payment credentials for the Russian payment path described in Section 1. The processor acts as an independent controller with respect to payment credentials; we receive only payment metadata (amount, status, tokenized references). See YooKassa privacy terms;
• An email delivery (SMTP) provider — delivery of verification codes and service notifications to your email address;
• Functional Software, Inc. (Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA) — error monitoring. We configure the integration to avoid sending direct contact details. See Sentry Privacy Policy;
• 650 Industries, Inc. (Expo, 650 Castro Street, Suite 120-219, Mountain View, CA 94041, USA) — push notification delivery, if you enable notifications. See Expo Privacy Policy.

Product analytics is processed on our own infrastructure and is not shared with third parties for analytics purposes. We may also disclose personal data to public authorities where required by applicable law, and to professional advisers (lawyers, accountants, auditors) bound by confidentiality obligations.

We do not sell personal data and do not share it for advertising or marketing purposes.

5. International data transfers

Some of the recipients listed above are located outside the Republic of Armenia, including in the United States (Google LLC, Apple Inc., Functional Software, Inc., 650 Industries, Inc.) and Ireland (Google Ireland Limited), as well as other countries where these providers or their subprocessors operate data centers. Where personal data is transferred internationally, we limit the transfer to the minimum necessary and rely on the safeguards offered by the respective providers.

6. Data retention

• Account data — for the life of the account and up to 12 months after its last activity or after a deletion request, subject to the statutory periods below;
• Refresh tokens — until rotation, sign-out, or expiry (at most 90 days);
• Email verification codes — until confirmed, until the attempt limit is reached, or until a new code is requested;
• Payment and subscription records — for the periods required by applicable tax and accounting legislation and for the duration of applicable limitation periods;
• Server logs — up to 30 days;
• Product analytics events — up to 90 days (aggregated, de-identified statistics may be kept longer);
• Error monitoring data — for the periods set by the provider (typically 30–90 days);
• Database backups — daily backups up to 7 days, weekly up to 4 weeks, monthly up to 12 months; data deleted at your request is re-deleted if restored from a backup;
• Support correspondence — up to 3 years after the request is closed.

7. Your rights

Subject to applicable law, you have the right to:

• access the personal data we hold about you and receive information about its processing;
• request rectification of inaccurate or incomplete data;
• request erasure of your data ("right to be forgotten");
• request restriction of processing;
• object to processing based on legitimate interests;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;
• lodge a complaint with a competent data protection authority.

The fastest way to delete your account is directly in the app: open Settings, tap your account (the row showing your email address), and choose "Delete account". You can also request deletion without reinstalling the app through our account deletion form.

To exercise your rights, email us at arpilabs@gmail.com with the subject "Data subject request", specifying the email address used in the Services and the substance of your request. We may ask for additional information to verify your identity. We respond within 30 calendar days; if more time is needed, we will notify you of the reason and the new deadline. Deleting your account does not remove records we are legally required to keep (such as payment records); these are retained for the statutory period with the minimum necessary scope of data.

8. Children

The Services are not intended for children under 13 — or the higher minimum age required in your country for consenting to the processing of personal data — without the consent of a parent or legal guardian. We do not knowingly collect personal data from children below that age. If we learn that such data has been collected without the required consent, we will delete it promptly.

9. Cookies and local storage

The website may use cookies and similar local storage technologies (LocalStorage, SessionStorage) for authentication, protection against automated abuse, and basic technical diagnostics. The mobile application uses the operating system's local storage facilities (an on-device database, key-value storage, and the system keychain/keystore) to store data required for app functionality. This data remains under your control and can be removed using standard operating system tools (deleting the app or clearing its data).

10. Security

We apply organizational and technical measures appropriate to the risk, including TLS encryption in transit, storage of tokens in the operating system's secure storage, separate secrets for different token types, restricted administrative access with key-based authentication, firewalls, encrypted backups with integrity checks, and tokenization of payment methods. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Changes to this policy

We may update this Policy from time to time. The current version is always available at https://arpilabs.com/privacy, with the effective date shown at the top. If the changes are material, we will notify you through the app or by email. Continued use of the Services after a new version takes effect constitutes acceptance of that version.

12. Governing law

This Policy is governed by the laws of the Republic of Armenia. Nothing in this Policy limits any rights you may have under mandatory provisions of the law applicable in your place of residence.

13. Contact

FAIZOV ARTUR, Individual Entrepreneur (Republic of Armenia)
Email: arpilabs@gmail.com
Website: https://arpilabs.com/